z-image-studio

The server handles file uploads and local image generation, utilizing subprocess calls for hardware detection. It employs path sanitization for outputs and parameterized SQL queries to prevent injection vulnerabilities. Image generation logic runs in a dedicated worker thread, which, while executing functions passed to it, is controlled internally by the server and not exposed to arbitrary user code. File size limits are enforced for LoRA uploads. No direct 'eval' or apparent hardcoded secrets were identified. Standard security practices for a local Python application of this nature are in place.